Active E-mail Filter with Challenge-Response

ABSTRACT

When a user receives potential junk e-mail from an unknown sender address, an active filter installed in or cooperating with the user&#39;s e-mail system sends a challenge e-mail back to the sender address. Unless the user receives a correct response e-mail from the sender address and/or a response that meets formal criteria, the active filter rejects the original e-mail and blocks future e-mail from that sender address. The challenge preferably includes a question that the sender must correctly answer in his response. The question is such that only humans can interpret and respond to it correctly. For example, the question may relate to and/or be incorporated in an image in the challenge. Lists of approved and blocked sender addresses are compiled. The user may directly enter addresses in the address lists. Addresses to which the user has sent e-mail may also be included directly in the approved list.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to a system and method for eliminating or atleast reducing the amount of unwanted electronic mail messages sent tousers of e-mail.

2. Description of Related Art

As the use of electronic mail (e-mail) has grown, so too has the amountof unwanted e-mail. This unwanted e-mail, commonly referred to as “junke-mail” or “spam,” is usually, but not always, some form of solicitationto buy some product or service.

Junk e-mail in the “Inbox” of e-mail programs is analogous to the “junkmail” that fills many mail boxes. The analogy is not perfect, however.Perhaps the greatest difference, besides the obvious difference inmedia, is that the marginal cost of sending junk e-mail to one morerecipient is essentially nil, whereas an address label must be printedand postage must be paid for each additional piece of junk mail sentthrough normal postal channels. Indeed, the alarming growth of the junke-mail industry depends on this cost efficiency. Even millions of e-mailaddresses can be obtained relatively cheaply, especially since manyorganizations that have complied such lists for other reasons are oftenhappy to get the “free” money that is to be had simply by selling them.Even absent such straightforward purchase, less scrupulous “junke-mailers” can still get at addresses by using known computer programsthat gain access to and download address lists from servers. Even moredisturbingly, junk e-mailers can also launch programs that cause centrale-mail servers themselves to propagate the junk e-mail to their owncustomers.

That junk e-mail is almost universally hated is of little concern to itscreators, once again because of the negligible cost: Assume that 9,999out of 10,000 who receive an e-mail solicitation for a $100 service areirate at having received it at all, but that one actually buys theservice. If the junk e-mailer manages to transmit just a million junke-mails with the solicitation, then he will still have made $10,000,which is typically far more than it would cost to generate thesolicitation. Moreover, note that there are even on-line companies thatspecialize in sending junk e-mail on behalf of others, usually for onlya few hundred dollars, thereby reducing the cost of sending mass junke-mail even further. Even these companies send junk e-mail advertisingtheir service, which constitutes junk e-mail that advertises a serviceto enable others to send junk e-mail!

It is not just countless recipients of junk e-mail who would like to ridthe e-mail system of it: The hundreds of millions of junk e-mailmessages sent every day (and perhaps every hour or minute) represent awaste of the bandwidth of the network (usually Internet) and thus a lossto e-mail service providers as well.

There are at present many different systems that attempt to filter outjunk e-mail. Some of these systems are incorporated in the user's e-mailprogram itself, others are installed in the central e-mail server, andstill others are separate applications that the user must load into hiscomputer.

Using perhaps the most common system, when a user receives unwantede-mail, he may direct his e-mail application to put the sender's addressin a “blocked” list. Future messages from the same address are thenprevented from reaching the user's Inbox, and are instead sometimesrouted to a special junk e-mail folder for optional review by the user.The weakness of this filtering method is that junk e-mailers can easilychange the address but keep the same domain name. The junk e-mail willthen pass this simple filter. Thus, the sender address “aaa@junk.ext”might be blocked, but “aab@junk.ext” will not be.

One improvement over simple address filtering is therefore to filterbased on domain names. There are two weaknesses to this approach. First,it is possible to change the “Reply to” or “From” address of a sente-mail message. Automatically generated, fake domain names can thereforebe sent along with junk e-mail to bypass domain name-based filters.Second, junk e-mailers often misappropriate common domain names,especially if the junk e-mail is being sent by a “Trojan Horse” programfrom within a widely used e-mail server; users may not want to block alle-mail from that domain.

Other known junk e-mail filters examine the routing information thataccompanies each e-mail in an attempt to identify the original addressfrom which the e-mail was sent. This will still not work when the e-mailis sent from within a central “trusted” server. Even so, junk e-mailersmay also use known techniques to cause their messages to be sent throughdifferent proxy servers and thereby to disguise their origin.

The “Active SMTP” technology of Escom Corp. represents another approach,according to which a sending e-mail host is probed while it is connectedto the recipient's server. If the sending host is a dial-up risk, or anopen relay, or is configured not to accept incoming e-mail (typicallyindicative of a forged address), then the Active SMTP system distruststhe sending host and rejects its e-mail. This system has at least twospecific weaknesses: First, it will not block unwanted e-mail such asblatant commercial advertisements if the sender is using regular e-mailsent from a properly configured mail server. Second, this system worksonly when the sending server is connected to the recipient server;consequently, such a system is not suitable for installation on users'local computer systems that download e-mail from a remote server.

Still other known junk e-mail filters examine not just addresses androutings, but rather (or in addition) some aspect of the content of themessages. Content is usually found either in the “subject line” of themessage, or the main text of the message, or both. It may also be foundin the message header. Assume such a filter is installed in a centrale-mail server. If a filter program notices that a million pending e-mailmessages all have the same subject line, or have message texts withidentical wording, then it is almost certain that these messages arejunk e-mail and can be blocked and deleted. To defeat such filters, junke-mail senders typically add random strings of characters in the subjectline (usually after many blank spaces or asterisks to make them lessobvious to recipients) or at the bottom of the texts.Character-by-character or word-by-word comparison of any two of the junkmessages will therefore show them to be different, although the onlydifference is the meaningless, random character strings includedspecifically to defeat the filters.

Other “tricks” used by senders of junk e-mail include fakepersonalization of the messages. Thus, by including all or some part ofthe recipient's name (extracted from his e-mail address or from a bulkaddress list) in the subject line, the sender attempts to fool therecipient into believing that the message is legitimate. For example,the text “Bob, here is the deal I told you about!” might be in thesubject line of a message sent to Bob@mailfront.com. This ruse alone maydefeat some known filters and may induce the unwitting recipient to openthe message. This trick of false familiarity is of course also wellknown from junk mail sent by post. Note that many of the methods used byjunk e-mailers resemble those used to transmit computer viruses, whichoften require that recipients be tricked into opening some executableattachment.

Legislation has done little to combat the plague of junk e-mail. Indeed,there is proposed federal legislation against “unsolicited commerciale-mail,” but it lacks provision for effective enforcement and hasloopholes through which junk e-mailers easily slip. Like laws, evasionis often a simple exercise in semantics. For example, many junk e-mailmessages include false or at best misleading statements indicating thatthey are not unsolicited, or not commercial. Some particularly brazenjunk e-mail even states explicitly that it complies with the veryproposed legislation it violates. All such statements are of courseintended to confuse recipients or at least make them believe they haveno recourse. Examples of actual statements received by the applicant'sattorney include:

-   -   “Below is the result of your feedback form.” (No feedback form        was ever submitted.);    -   “Note: this is not a spam email. This email was sent to you        because your email was entered in on (sic) one of our websites        requesting to be a registered subscriber.” (No such request had        ever been submitted.)    -   “THIS IS NOT AN OFFER OR CONTRACT TO BUY INSURANCE PRODUCTS, but        rather a confidential informational inquiry” (attempting to        circumvent the prohibition against unsolicited commercial        e-mail); and    -   “This message is being sent in compliance of (sic) the email        bill: Section 301.per section, paragraph (a) (2) (c) of S.        1618.”

Still other junk e-mail filters work by searching the message forcertain predetermined, prohibited keywords. Any messages that containany of the keywords are blocked and are not passed through to the user'se-mail application. These filters thus operate in the same manner as(and often are) known filters designed to eliminate pornography or otherobjectionable subject matter. The problems of over- andunder-inclusiveness of these systems are well documented.

The general weakness of all of the known junk e-mail filters mentionedabove stems from the fact that they are passive: They attempt todetermine whether a message is junk e-mail based solely on an analysisof information extracted from and relating to the message and itssending server. As such, the senders of junk e-mail, like car thievesworking to defeat alarms, can evolve their techniques so as to defeatthe latest filters.

What is needed is a mechanism for eliminating or at least greatlyreducing the successful transmission of unwanted e-mail while stillmaking it easy and convenient to receive wanted e-mail. In other words,e-mail from unwanted senders should be effectively blocked, with aslittle interference as possible with e-mail from approved senders. Itshould also be impossible—or at least exceptionally difficult—for junke-mailers to bypass the filter. This invention provides such amechanism.

SUMMARY OF THE INVENTION

The invention provides a method and system implementation for filteringelectronic mail (e-mail) according to which, when a current e-mailmessage is received from a sender address, a challenge that requires acorrect e-mail response is returned, also by e-mail, to the senderaddress. In the simplest embodiment of the invention, the current e-mailmessage from the sender address is then rejected unless the correcte-mail response is received by the user system from the sender address.All future e-mail messages from the sender address are preferably alsoblocked.

The challenge includes an instruction to perform an action; the correcte-mail response requires correct performance of the action. Thechallenge is preferably in the form of a question that must be correctlyanswered, and preferably includes an element that only a human cancorrectly interpret, such as an image, audio clip, text question whoseanswer requires human experience, etc. The challenge is preferablygenerated automatically by a corresponding software module, which mayalternatively download challenges from an external system.

Challenge responses that do not meet formal criteria are preferably alsorejected. Such formal criteria include response within a maximum allowedtime and answering correctly within a maximum number of tries.

When a correct e-mail response is received from the sender address, thatsender address is preferably included in a list of approved senderaddresses and the current e-mail message may be accepted, meaning thatit is passed for display to and review by the user, for example in anInbox. The user may optionally directly specify e-mail addresses to beincluded in the list of approved sender addresses. Other e-mailaddresses that may be assumed to be welcome and may be included directlyin the approved list are those to which the user himself has initiatedsending e-mail and addresses obtained from an externally compiledapproved list.

When an incorrect e-mail response is received from the sender address,that sender address is preferably included in a list of blocked senderaddresses. The current and future e-mail messages from the currentsender address, or from any other address in the blocked list, are thenrejected without further challenge. The user may also optionallydirectly specify e-mail addresses to be included in the blocked list;other blocked addresses from an externally compiled list may also beincluded. The list of blocked addresses may optionally be exported toother users.

Rather than automatically issuing challenges whenever e-mail is receivedfrom an unknown address, the system may instead notify the user ofreceipt of e-mail messages from such addresses and prompt him toindicate whether to send a challenge, to reject the message immediately,or to accept it without challenge.

For each challenge, a key is preferably calculated and included in thechallenge. Received e-mail that includes a correctly calculated key maythen be accepted without challenge (since it itself should be achallenge), or accepted directly if the key is correct and the messageis from a sender address to which the user previously initiated sendinga message.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an example of a text-based challenge to an e-mailsender.

FIG. 2 is a flowchart of the main steps performed by the active,challenge-response e-mail filter according to the invention.

FIG. 3 is a block diagram of the main hardware and software componentsused in the e-mail filter system according to the invention.

FIG. 4 illustrates an example of the structure of a buffer used to storeinformation about e-mail messages whose senders are being challenged toprove they are human.

FIG. 5 illustrates an image-based challenge with an automaticallylaunched, one-click response.

FIG. 6 illustrates an image-based challenge that requires a manuallytyped textual response.

FIG. 7 illustrates an example of a user interface that enables a user toturn the invention on and off and to activate prompted messagechallenging.

DETAILED DESCRIPTION

In broadest terms, the invention provides a mechanism for filteringe-mail messages that eliminates or at least greatly reduces the numberof unwanted messages received. Unlike existing, passive filters, theinvention achieves this by requiring the sender of questionable e-mailto prove that he is in fact human and not an automated mass-mailingsystem: Upon receipt of a message of unknown origin, an active filter inor associated with the recipient's e-mail system returns a challenge tothe sender, which the sender must correctly respond to before theoriginal message is actually passed on to the user. The challenge willtypically be a question sent in a reply e-mail message, which the sendermust correctly answer, also by e-mail. The filtering mechanism accordingto the invention is therefore active in that it puts the “burden ofproof” on the sender rather than simply trying to passively identifymass or similar unsolicited e-mailings based solely on analysis of theinformation received.

By now, almost everyone in every industrialized country is very familiarwith the structure and handling of an e-mail message. For the sake ofcompleteness, however, this is summarized here: The “title” of an e-mailmessage is usually put in a “subject line,” which the user's e-mailprogram displays along with the sender's address, the time and date themessage was received, the size of the message, and possibly otheridentifying and general information, usually on a single line. As partof the standard protocol, an e-mail message also includes informationthat is not usually displayed, at least not by default. One example ofsuch included but non-displayed information is a header.

If the user wants to view the main text of the message, he clicks on thesubject line and the text is displayed on a separate part of the displayscreen. The message can then be deleted, forwarded, replied to, etc., byclicking on corresponding on-screen icons. Messages typically are firstdisplayed in an Inbox folder, but they can be moved to other folders,usually by simple dragging and dropping using a mouse. Received messagescan also be grouped automatically into different folders upon receipt;for example, different users of the same e-mail program can have theirown, separate default folders in which as yet unread e-mail is firstplaced.

Another common feature of modern e-mail programs is that they canautomatically reply to received messages. This feature is often used tonotify senders that the recipient is out of the office or otherwiseunable to reply personally. This invention makes use of the ability toautomatically send a reply to a received message.

The invention may be implemented either in each recipient's computer, orin a central e-mail server, or in an intermediate system, or in anycombination of these. Here, just by way of example, it is assumed thatthe invention is included in the recipient's local system as part of theinstalled e-mail program, or as a separate filter component thatcooperates with this program.

Assume by way of illustration that a sender identified as“John@mail.ext” sends a message to a recipient whose e-mail address is“Fedup@mailfront.com.” Assume further that the subject line of themessage is:

-   -   “Get out of debt!!!************x3zvi1”        Before this original message is passed to and listed in Fedup's        e-mail Inbox, a challenge message is automatically generated and        sent to John@mail.ext by Fedup's system, in particular, by the        active filter according to the invention. The challenge includes        a question, or a direction to perform some other action, whose        correct answer or action must be part of a response that the        sender returns to Fedup. The invention does not pass the        original message to Fedup's Inbox unless the sender correctly        responds to the challenge.

FIG. 1 illustrates the operation of a simple embodiment of theinvention: In response to the original “Get out ofdebt!!!************x3zvi1” message, the intended recipient's (Fedup's)system returns to “John@mail.ext” a challenge, which, assumingJohn@mail.ext is even a valid address, would normally be displayed in awindow 110 of a display 100 generated by a “John's” conventional e-mailprogram. (Typical toolbars 112 and 114 are also illustrated.) In thisexample, the challenge is part of a standard text message, and directs“John” to reply to the question “7×8=?” If, in response, John sends backto Fedup a message with the correct answer 56 as the first line, thenFedup can be almost certain that the sender at John@mail.ext is at leasthuman, as opposed to being a mass-mailing program. The address“John@mail.ext” may then be added to a list of verified, approved,“welcome” senders so that future messages from that address will beaccepted with no need for response to another challenge.

The invention may include not only the substantive response criterionthat the sender must respond correctly to the challenge, but also one ormore formal criteria relating, for example, to the timing and manner ofresponse. Formal response criteria include response within a setresponse period and/or submission of no more than a maximum number ofattempted but incorrect responses. Other formal criteria such as thesending server being configured to accept e-mail and not having openrelays may also be chosen and implemented using normal design methodsand heuristics.

If “John@mail.ext” responds incorrectly, or fails to meet any otherincluded formal response criterion, then the invention infers that“John” is not a valid or welcome sender, and the original message iseither blocked altogether or is placed in a “Reject” folder that Fedupcan view if he so chooses. The address “John@mail.ext” is thenpreferably also added to list of blocked or “unwelcome” senders, so thatfuture messages from that sender will not be challenged again, but willalso not be passed to the recipient.

It is not necessary according to the invention for only completeaddresses to be analyzed. Rather, address approval and blocking may bedone on the basis of the domain (such as “mail.ext”), regardless of thesender's name. This is equivalent to allowing “wildcards” in theaddresses. Thus, blocking or approving “*@mail.ext” would correspond toblocking or approving all mail from mail.ext. So as not to block (orpass) all messages from widely used domains, various heuristics shouldbe implemented; these may be chosen using normal design considerations.

The active filtering mechanism according to the invention may beinstalled at different levels in a recipient's e-mail “stream.” Forexample, the active filter may be installed in the central e-mail severthat first receives e-mail over a network from the sender. In this case,the invention may be used to help all users connected to the centralserver. The invention may also be integrated into each recipient's locale-mail program, or installed in any conventional manner (such as from aCD ROM or downloaded via the Internet) as a component that cooperateswith this program.

The invention may also be installed in intermediate systems, that is,computers operating between each recipient's local e-mail applicationand the central e-mail server. For example, an enterprise such as acompany or any other organization that maintains for different users acommon connection to the general, external e-mail network (such as theWorld Wide Web) might prefer to install a single copy of the inventionin the system that is responsible for the interface with the externalnetwork. This can be considered a “perimeter” installation inasmuch asthe invention will then operate at the software and hardware “perimeter”separating the enterprise from the public part of the network, which theenterprise does not control.

As is explained in greater detail below, the invention allows not onlyjunk e-mail to be detected and blocked, but e-mail sent fromuser-specified and even externally compiled addresses and domains mayalso be blocked. The “perimeter” installation of the invention may thenbe used to enable the administrator of the enterprise system to bettercontrol the flow of e-mail into and out of the enterprise as a whole.Perimeter installation will also reduce the bandwidth drain on theenterprise's e-mail system even on the way to the central e-mailservers.

The invention may also be included in a suite of junk e-mail filters.Using conventional input methods, such as moving a slider or checking acheck box, the user can then adjust the level of security of his e-mailsystem. A relatively low setting could indicate that only conventionalsubject-line analysis should be used to filter incoming e-mail. Theactive filter according to the invention, with challenge-response, wouldthen be the highest setting, since it has the most stringent requirement(accurate, human response) to avoid rejection.

FIG. 2 is a flowchart that shows the main steps performed by theinvention: When an e-mail message arrives at the recipient's system (orat whichever system the invention is installed in), the sender's addressis first compared with the addresses already in the Approved or Blockedlists 360, 362. If the message is from an approved sender, then themessage is passed directly to the user's e-mail program (for example,Inbox) for display and review. If, however, the message is from ablocked address, then it may either be deleted or, preferably, placed ina Reject folder. The user may, optionally, also be notified that amessage has been blocked so that he may review either the address or themessage or both.

If the sender's address has not been analyzed before, then the messageand its address are held in a “Pending” folder or list and a challengeis generated. The challenge may be “standardized,” that is, the same forall senders, until updated by the user, or it may be generated anew foreach sender. The example challenge (simple multiplication) in FIG. 1could, for example, easily be changed for each message to includedifferent multiplicands.

Challenge generation may be automatic, or according to user input, or acombination of both. To continue with the example of a simpletwo-operand arithmetical challenge such as “7×8=?”, the active filteraccording to the invention (in particular, a challenge generationmodule—see below) could generate such challenges from a basicgeneralization, such as “M Op N=?” where M and N are chosen randomlyfrom some predetermined set of whole numbers and Op is an operatorchosen randomly from a group such as addition, subtraction andmultiplication. Such randomization would enable the system to easilygenerate different challenges for different potential junk e-mailers.

The challenge is then sent automatically as a reply to the sender (here,John@mail.ext). The system then waits for the sender's response to thechallenge. A maximum response time is preferably implemented; failure torespond correctly in the allotted time leads to the original messagebeing blocked and the sender's address being put in the Blocked list.

If the sender does respond, then the response is checked to determine ifit is correct. If it is, then the sender's address is put in theApproved list and the original message is passed to the recipient. It isof course possible that a valid, welcome sender may answer incorrectlyby mistake. Moreover, a welcome sender may send the original message andthen log off and leave his computer for longer than the expectedturn-around time for an immediate response to a challenge. According tothe invention, senders may therefore optionally be given more than oneopportunity to respond to a challenge before they are blocked and/orthey may be given a time for response long enough to take into accountnormal e-mail habits. If the number of permitted response attempts(which may be one) has not yet been exceeded, and/or the response periodhas not yet expired, then a new challenge is preferably sent to thesender. If the number of attempts and/or the allowed response time hasbeen exceeded, then the sender's address is added to the Blocked listand the original message itself is either deleted or placed in theReject folder.

It would also be possible—but would provide much weaker security—forpurely formal criteria to be sufficient. In other words, the challenge“question” might be a “null” question, meaning that any response sentfrom the same sender address within a set period might suffice to havethe sender address be included in the Approved list. For example, thechallenge could simply be “Reply to this e-mail message.” Thisminimum-security challenge could be defeated with an auto-reply featurein the sender's system, but it would work against the many junke-mailers who send messages from invalid, or frequently changing,addresses. Even if the sender's system generates an automatic response,the invention would serve to confirm that the junk e-mail sender'saddress is valid and relatively stable—this in itself would make iteasier to identify the sender and possibly stop his junk e-mailactivities using other techniques, including legal means.

Even at this point, the advantages of the invention should be clear: Fewsenders of mass junk mail (especially where the senders are automated)will be able to respond to individual challenges. Even if the junke-mailer is determined enough to try, responding individually to even ahundred intended recipients (to say nothing of thousands or millions)would greatly increase the burden and cost of sending junk e-mail. As anadded advantage, assume that the junk e-mailer sends 10,000 junk e-mailmessages from his own computer, using a valid “From” address, and thatall of the 10,000 recipients are wise enough to have installed theinvention. The junk e-mailer's computer would then receive 10,000challenge messages, which, one hopes, would inconvenience the junke-mailer enough to act as a deterrent.

General System Configuration

FIG. 3 shows the main components of the active filter 300 according tothe invention, which is included within or cooperates with anyconventional e-mail application 310 such as Microsoft Outlook, Eudora,etc., or the conventional e-mail software of any conventional e-mailserver. As is mentioned above, the active filter 300 may be included aspart of the user's local e-mail application 310, or within the e-mailserver 312 via which the user receives and sends e-mail. The activefilter 300 is shown as a separate sub-system merely for the sake ofclarity. Similarly, at least the e-mail application 310, and preferablythe active filter 300 as well, are installed as software components,that is, stored, as executable computer instructions and related data inthe user's local computer system 320. Again, they are shown separatelyfor the sake of clarity.

A sender 330 sends an e-mail message to the recipient's e-mailapplication 310 via a network 340 such as the Internet and therecipient's e-mail server 312. Before the application 310 displays themessage, however, it is first passed to the active filter 300. Anaddress analysis module 350 checks the lists of approved, blocked andpending addresses 360, 362, 364, respectively, to determine whetheranalysis is needed at all. Messages from approved addresses may bepassed directly to the user's Inbox (or other designated folder) usingthe normal routines in the e-mail application 310. Messages from blockedaddresses may be sent directly to a Rejected folder 366 (preferablywithin the e-mail application itself 310).

Any message from an address that is in the Pending buffer 364 is passedto a response analysis module 370, which compares the response (if any)in the message with the correct response. If the response is correct,then the address record is removed from the Pending buffer 364 and maybe entered into the Approved list 360. The original message (held in thePending buffer 364) can then be passed to the e-mail application 310 fornormal display to the user. Future e-mail from any address in theApproved list 360 can then be accepted and passed on to the user withoutfurther challenges—welcome senders of e-mail will therefore need tocorrectly answer a challenge only once. If the response is incorrect,the sender may optionally be given yet another try. If a “retry”possibility is implemented, the decision as to whether to allow anothertry may be based on whether a set response period has expired (which canbe determined by comparing the original transmission time against thetime and/or date information available from the operating system) and/orwhether a maximum number of failed attempts has been exceeded (which canbe tracked by incrementing a counter in the Pending buffer record), oron other formal response criterion.

Note that the invention may be used together with other e-mail filters.Any message that contains a prohibited keyword, for example, or failssome other test, such as having a content or structure indicative ofjunk e-mail (such as strings of random characters after several blanksspaces or asterisks in the subject line, or in the message text), couldbe automatically rejected and the sender's address may be blocked,regardless of the response.

Assuming that the response is incorrect and that the sender is to beallowed another try, a challenge generation module 372 either resendsthe original challenge or generates a new challenge that is sent to thesender.

A sender may send more than one message during a given response period.There might therefore be more than one pending record for the sameaddress in the buffer 364. If the sender correctly responds to the firstchallenge but allows the period for the second to expire, then hisaddress might end up in both the Approved and the Blocked lists. One wayfor the address analysis module 350 to handle this possibility is togroup all pending messages by address, or to scan the Pending buffer forduplicate addresses, whenever a new message is received. The results ofthe first response analysis corresponding to the duplicated address canthen be applied to all messages from the same group—one correct responsefrom a sender will cause all the messages from that address to be“released” for display and response failure will cause all the messagesto be rejected.

Another way to handle this possible contradiction is for the addressanalysis module to periodically compare the Approved and Blocked addresslists—any address that is both blocked and approved should probably beapproved because the sender will have correctly responded to at leastone challenge. Alternatively, the contradictory status can be flaggedfor the user, who may then manually decide whether to approve or blockthe ambiguous address.

If the address of the message is new, that is, is not found in any ofthe lists 360, 362, 364, then the challenge generation module 372creates and transmits the challenge back to the sender.

The invention preferably includes a user update module 374 with whichthe user communicates using any conventional input device. Upon useractivation (for example by clicking on a displayed icon or selectingthis feature from a menu), this module 374 allows the user to view,edit, add and delete addresses in the Approved and Blocked lists 360,362, and preferably to easily move an address from one list to theother. Moving addresses and messages between e-mail folders using simple“drag-and-drop” is a known feature of most modern e-mail programs. Forexample, a user's friend may have failed to respond correctly, or ontime. He will then notice that his mail never seems to reach the user.In this case the user can simply move the friend's address to theApproved list. Conversely, a junk e-mail system, aware of the invention,may have been lucky enough to guess a correct response; upon seeing thejunk e-mail, the user can then manually put the unwelcome address in theBlocked list 362.

Many users want to receive some mass-mailed e-mail, for example, a dailysummary of news headlines, or mailings from organizations to which theybelong, or even solicitations such as notices of last-minute deals fromairlines. Such welcome senders would not be able to respond correctly toa challenge. The user can then enter these known, welcome addressesdirectly into the Approved list via the user update module 374 usingconventional input techniques.

FIG. 3 also shows a “Junk E-Mail Database Service” 390 connected to thenetwork 340 and accessible to the user's e-mail program 310 andtherefore to the active filter 300. This optional system may providedifferent services depending on any given implementation of theinvention. In one configuration, the service 390 itself hosts the activefilter 300, and filters e-mail on behalf of users who receive theire-mail via the service 390. In another configuration, the service 390makes available to users updates of the active filter, includingchallenge updates. These features are described further below.

FIG. 4 shows an example of the Pending buffer 364, which holds dataconcerning messages being held pending response (or lack thereof) to achallenge. For each potential junk e-mail message, a record ispreferably included in the buffer that has, as fields, data such as thesenders' addresses (addr_1, . . . , addr_m), the subject lines and textbodies, the respective challenge(s), correct response(s) (assumingindividualized challenges), and statistics such as the time thechallenge was sent (the start of the response period), the number ofresponse attempts, etc.

Challenges

The challenge illustrated in FIG. 1 is entirely textual, and can beimplemented easily in all modern e-mail programs: Regardless of thee-mail formatting used, the challenge will still be understandable, anda simple “Reply” message will suffice to return the response. Thischallenge format has the added advantage that the user can easily createchallenges. The line connecting the user system 320 and the challengegeneration module 372 in FIG. 1 illustrates the (optional) ability ofthe user to select or change challenges. Accordingly, in thismanual-challenge embodiment, the user can create new challenges or editexisting ones. For example, the user could change the multiplicands inthe challenge “7×8=?”; he should then enter the correct answer in theresponse analysis module 370 using any conventional input arrangement.

Once junk e-mailers become aware of a new filter, they usually set aboutdeveloping automated ways to defeat it. It would thus be possible forparticularly clever junk e-mailers to try to use a parsing program toparse the challenge and automatically produce a correct response.Allowing the user to create challenges and input them (using anyconventional input technique) to the challenge generation module 372 mayhelp overcome this potential weakness. If the text challenge requiresspecific or even general knowledge not commonly within the realm ofcomputers, then automatic response generation will be difficult if notimpossible. For example, no parser would correctly respond to thechallenge: “What is my daughter's first name?” Indeed, this is also anexample of a challenge that would exclude most human junk-mailers. Otherchallenges could easily be written to block e-mail from people who donot readily know, say, algebra or Swedish or classical guitar, or apassword.

Most modern e-mail programs allow messages to be sent in or includeelements created using mark-up languages such as HTML and image formatssuch as JPEG. The preferred embodiment of the invention takes advantageof this capability to generate challenges that cannot be parsed at all,because the challenges require correct interpretation of an image. FIG.5 illustrates an example of such a challenge.

In FIG. 5, the challenge has been sent to the sender as before, but thechallenge message includes an image 500, which includes a challengequestion as part of the image. In the illustrated example, two flowersare shown, and the challenge is to correctly indicate the number offlowers. To make responding easy and relatively fail-safe, in theillustrated example, four input fields (the “button” icons labeled 1-4)are included in the image. To respond to the challenge, the sender maysimply position a cursor 510 over the button indicating the correctanswer and then “click” on the button. By including conventionalscripting along with the challenge message, the sender's(John@mail.ext's) e-mail program can then automatically send theresponse back to the recipient (Fedup@mailfront.com) as soon as thesender clicks on his choice of answer. Note that an image-basedchallenge tests that the sender is human in two ways: First, the sendermust see and interpret the picture and the question; second, he mustperform the physical acts of positioning the cursor 510 over the correctanswer button and then also click a mouse or similar input device.

One other advantage of image-based challenges (with text also in theimage format) that can be answered by clicking on multiple-choicebuttons is that they can be used readily for languages whose alphabet,symbols or characters are not supported by standard e-mail programs orbrowsers.

FIG. 6 illustrates a challenge that combines image interpretation and amanual, text response. In this case, to respond correctly, the sendermust physically type “right” into a response message. FIG. 6 alsoillustrates how any text included in a challenge image is preferably putin a font, color, style, etc., and/or is “obscured” with other graphics(such as the surrounding dashed boxes) so as to defeat any attempts to“decipher” the image using optical character recognition.

Other non-textual challenges may also be generated according to theinvention. For example, the challenge could include an audio file (forexample, in MP3 format), or a moving or changing image (in, for example,MPEG format), with a challenge question or action that presupposes anability to interpret and/or react to the audio or active-imagechallenge. The challenge question could, for example, be spoken in theaudio file, or could be presented as scrolling text. These non-textualand indeed non-visual challenges may of course be combined with thetext- and image-based challenges described above.

In the preferred embodiment of the invention, the challenge generationmodule 372 automatically chooses which challenge to issue to senders,for example, from a database of challenge texts and/or images, etc.,included as part of the active filter. One advantage of this isconvenience: The user does not need to think of appropriate challenges,so that different challenges can easily be issued to even a large numberof different sender addresses. Note that it will often not be necessaryto have available a large number of different challenges—even a single“standard” challenge will still require human interpretation and actionfor correct response. Whenever a new challenge is required, the module372 may then, for example, choose it randomly from the database. Anotheradvantage is that automatic generation ensures that challenges will bein the correct format. Still another advantage is that new challengescan be downloaded from a provider via the Internet, for example as partof a periodic update routine. Such automatic updating via the Internetis a well known procedure used, for example, by all major providers ofanti-virus software.

Much junk e-mail is sent from forged addresses. Any challenge sent tosuch an address will typically result in the return of a “bounce” errormessage, that is, an e-mail message stating that the challenge wasundeliverable. The From address of such an error message is usually“postmaster@domain.ext” or “route@domain.ext” where “domain.ext” is thedomain name and extension used in the junk e-mail message. The text ofthe undelivered message is, moreover, typically included as part of theerror message, as well as the address to which the message could not bedelivered. This provides yet another way for the response analysismodule 370 to determine that a message is junk: Whenever a message isreceived from, for example, “postmaster” or “route,” then the module cancheck the domain name and text to determine which challenge the errormessage corresponds to. The sender address that caused the bounce canthen be assumed to have sent a junk e-mail and can therefore be placedin the Blocked list.

The response analysis module 370 preferably also immediately blocks thesender address and the original e-mail message if, instead of a correctresponse to the challenge, an auto-reply message is returned. That amessage is generated by auto-reply can be determined using knownmethods. For example, according to current e-mail standards, allauto-reply messages have an “x-” header that specifies that the messageis “precedent bulk.”

Still another situation that the active filter preferably automaticallyinterprets as indicating junk e-mail is when an incoming e-mail messagehas, as its “From” address, the user's own address. In other words, ifthe “From” address is identical to the “To” address, then the messagecan be assumed to be junk. Because blocked messages and their addressesare preferably stored in the Reject folder and Blocked list for laterreview, the user will still be able to retrieve any message that hedeliberately sent to himself, for example as the result of sending a“Reply to all” message. Alternatively, by keeping track of identifyinginformation for any “Reply to all” message sent, for example, themessage body, the active filter could automatically approve withoutchallenge any received message that has the identifying information.

Anti-“Ping-Ponging”

Assume that the invention is installed in the computers of two differentusers U1, U2, neither of whom are junk e-mailers. When U1 sends a firstmessage to U2, U2's computer will return a challenge C1 to U1. U1'sactive filter will interpret this challenge C1 either as an incorrectresponse, or as incoming e-mail, which will cause it to issue achallenge C2 to U2, whose active filter will interpret C2 either as anincorrect response to C1, causing blocking of U1's address, or as yetanother message, causing generation of yet another challenge C3, and soon. The result will therefore be either that U1 and U2 block eachother's addresses, or that their active filters will begin an endlessseries of “ping-ponging” challenges.

One way to prevent, or at least cut off, ping-ponging is for the activefilter to set a limit on the maximum number of challenges issued to anygiven address during some predetermined time period. If the limit isreached, and if all messages received from the sender are at leastsubstantially identical, and if they are not auto-replies, then theactive filter can assume that the two systems are ping-pongingchallenges to each other. The active filter can then handle thissituation in different ways depending on user or designer preferences.For example, the first returned message in a ping-pong sequence can thenbe passed to the Inbox for review. Alternatively, if the active filterdetermines that ping-ponging is happening, then after a predeterminednumber of “rounds,” the active filter could notify the user, forexample, using a pop-up window, indicate the remote address involved,and prompt the user to decide whether to accept the original message orreject it (and block the sender's address) without further challenge.

In the preferred embodiment of the invention, ping-ponging is preventedby including a key in each challenge generated, for example, in theheader. Upon receipt of any message that includes a valid key, theactive filter will then know that the incoming message is a challengeand may then automatically approve the sender address and pass themessage to the user's Inbox without issuing a challenge.

The key may be a single number generated using, for example, a weakalgorithm such as a checksum, or a strong algorithm such as those usedto for public-key cryptography, or any other known encryption routine.The basis of the key is preferably all or some portion of the outgoing(challenge) message, including the From and To addresses. Other basesmay of course also be used, such as those that are functions of thetime, or some random number. This information will be available to theactive filter in the receiving system, so that it too can calculate thekey. If the key is correct, then the recipient system knows that themessage was sent by a system that incorporates the invention and canprobably be trusted.

It would be possible for particularly determined and skilled junke-mailers to install the invention in their own systems, then generatefalse messages to themselves “from” the addresses to which they wish tosend junk e-mail. The “challenge” their systems would then send would bethe junk mail message, with a valid key, which might pass through theactive filter of the recipient's system at the “real” addresses. Therecipient's system will not have sent any message to the “From” addressof the junk e-mail, however, so this fact can be used to override thekey and block the message and junk e-mailer's address: Since the key ispreferably included only in issued challenges, the recipient should notreceive any “challenge” with a valid key from any address to which ithas not initiated e-mail exchange. An incoming message (usually achallenge) can therefore be passed directly to the Inbox of therecipient if the incoming message has a valid key in its header and therecipient's system earlier initiated a message to the sender of theincoming message.

Automatic generation of challenges also helps prevent this deception,since it can ensure that all challenges must conform to a predeterminedformat. Even if a correctly calculated key is found in a message header,but the message body does not conform to the predetermined format, thenthe active filter will know that the incoming message is not a validchallenge. Other conventional filter mechanisms may also be employed inthis case to detect junk content.

Imported and Dynamic Address Lists

In the embodiments of the invention described above, a sender's addressis included in the Approved list 360 when the sender correctly respondsto a challenge. This is not the only way to build up this list in thepreferred embodiment of the invention. To avoid sending challenges tosenders who are already known to be welcome, the active filter 300according to the invention preferably puts in the Approved list 360 anyaddresses to which the user himself manually sends or has sent original(and, possibly, reply) e-mail messages. The filter 300 could also importthe addresses in the “address book” of the user's e-mail program 310.The Approved list can thus be built up dynamically.

In another embodiment of the invention, externally compiled, approvedaddresses are imported for inclusion in the user's list 360. Assume forexample that the user is a new employee at a company. His computer'sApproved list could then be loaded initially with the addresses of allthe other employees, of known customers and vendors, etc. Suchcompany-wide Approved lists could also be updated periodically by asystem administrator. As the user sends and replies to e-mail, hisApproved list will therefore grow dynamically to include addressesapproved both “globally,” that is, from the company-wide list, and“locally,” that is, approved as the result of correct challengeresponses.

Addresses known to be globally unwelcome or prohibited could similarlybe downloaded or stored in the Blocked list 362. These “globally”blocked addresses could also be made “undeletable” by marking themappropriately and coding the user update module 374 so that it does notallow the user (but rather only an administrator) to remove theseaddresses from the Blocked list 362 or move them to the Approved list360.

Dynamic compilation of the Blocked list 362 may also be used inimplementations in which the active filter 300 is included in thecentral e-mail server 312, to which many users are typically connected.If the address of a junk e-mailer is blocked centrally, not only wouldthis prevent the junk e-mail from reaching all those connected to theserver, but it would also prevent the waste of bandwidth. The usersconnected to the server could also be allowed to participate in buildingup the Blocked list 362. In this case, for example, if more than aminimum number of users indicate to the central sever that a particularaddress is used for junk mail, then the central server could include itin the global Blocked list. In order to prevent a coordinated “attack”against a legitimate sender, the administrator of the central servershould preferably review all such globally blocked addresses.

FIG. 3 also illustrates an extension of the concept of a central list ofblocked addresses. As shown in FIG. 3, a third-party “Junk E-MailDatabase Service” 390 may be included and made accessible to the uservia the network 340. According to this embodiment of the invention, theservice 390 preferably includes a copy of the active filter 300, as wellas any other conventional junk e-mail filters. The service preferablynot only detects junk e-mailers' addresses (and/or domains) using theinvention, but also actively seeks them out. Regardless of the methodsused to identify junk e-mailers' addresses, the service 390 includes aBlocked list, preferably in the same format as those used in the activefilter 300 of user systems. The Blocked list in the service 390 istherefore a global list that may be accessed by users and downloadedinto their respective Blocked lists 362. The service 390 may provideblocked address lists by subscription, or it may be associated with thee-mail service provider (usually, but not necessarily, the same as theuser's Internet Service Provider). Users who subscribe to the service390 may then download the updated global Blocked list, which is added tothe locally blocked addresses in each user's respective system.

FIG. 7 illustrates one example of a graphical interface that allows theuser to control the active filter according to the invention, and thatalso allows for prompted challenge generation. In the illustratedexample, the user is writing an e-mail message to Brian@mailfront.comusing a standard e-mail program; the interface may be included in otherapplications as well, for example, a browser. A window 710 is shown on adisplay screen 700, along with toolbars 712 and 714. In this example,the user accesses the features of the active filter via a drop-down menu720, which is activated by clicking on a “Verify” tool on toolbar 712.Any other conventional access arrangement may of course be implementedinstead.

The drop-down menu allows the user to turn the active filter on or off,that is, to enable or disable the challenge-response mechanism of theinvention, and, if implemented, to activate prompted challenges.Additional features that the user may be allowed to access include theApproved and Blocked lists so that addresses stored in these lists maybe added, deleted, edited or moved.

When prompted challenging is activated, the active filter does notautomatically generate challenges and analyze responses for e-mailmessages from as yet unclassified (approved, blocked or pending) senderaddresses. Instead, when the user's e-mail program receives a messagefrom an unclassified address, the challenge generation module 372 (orsome other dedicated module) causes a pop-up window 730, call-out, etc.to be displayed to notify the user that unclassified e-mail is incoming,that is, has been received but not yet approved for display. The addressof the incoming e-mail and, optionally, all or part of the subject line,are also preferably displayed. By clicking on the desired choice, theuser can then select to directly approve the address and permit themessage to be entered in his Inbox, to block the address and reject themessage, or to instruct the active filter 400 to generate a challengeand act according to any response or lack of response. In FIG. 7, forexample, the user has chosen to have the message from John@mail.extchallenged.

1. A method for filtering electronic mail (e-mail) sent to a usercomprising: receiving a current e-mail message from a sender address;via e-mail, returning to the sender address a challenge that requires acorrect e-mail response; and blocking the current e-mail message fromthe sender address unless the correct e-mail response is received by theuser system from the sender address.
 2. A method as in claim 1, furtherincluding the step of blocking future e-mail messages from the senderaddress unless the correct e-mail response is received by the user fromthe sender address.
 3. A method as in claim 1, in which the challengeincludes an instruction to perform an action, the correct e-mailresponse requiring correct performance of the action.
 4. A method as inclaim 3 including the sub-step of including a question in the challenge,in which the action is answering the question.
 5. A method as in claim 3further comprising the sub-step of including an image in the challenge.6. A method as in claim 5 including the sub-step of incorporating alegible question as part of the image, in which the action is answeringthe question.
 7. A method as in claim 5 further comprising the sub-stepof including in the challenge, in a text format, a question about theimage, in which the action is answering the question.
 8. A method as inclaim 3, further comprising user selection of the challenge.
 9. A methodas in claim 3 further comprising the sub-step of including an audio filein the challenge.
 10. A method as in claim 3 further comprisingdownloading challenges via a network from an externalchallenge-generation system and selecting for sending to the senderaddress at least one of the downloaded challenges.
 11. A method as inclaim 3, further including the step of blocking the current e-mailmessage from the sender address unless the correct e-mail response isreceived according to a formal response criterion.
 12. A method as inclaim 11, in which the formal response criterion is receipt by the userfrom the sender address of an e-mail response within a response period.13. A method as in claim 11, further comprising allowing multipleattempts to return a correct e-mail response from the sender address bysubmitting at least one additional challenge to the sender address uponreceipt of an incorrect e-mail response from the sender address.
 14. Amethod as in claim 13, in which the formal response criterion is receiptby the user from the sender address of the correct e-mail responsewithin at most a predetermined maximum number of the multiple attempts.15. A method as in claim 3 further comprising the following steps: uponreceipt of the correct e-mail response from the sender address,including the sender address in a list of approved sender addresses andaccepting the current e-mail message; and accepting without challengeany e-mail message sent from an address included in the list of approvedsender addresses.
 16. A method as in claim 15, further comprising thestep of including user-specified e-mail addresses in the list ofapproved sender addresses.
 17. A method as in claim 15, furthercomprising the step of including in the list of approved senderaddresses any e-mail address to which the user has initiated sending ane-mail message.
 18. A method as in claim 15, further comprising the stepof including in the list of approved sender addresses e-mail addressesobtained from an externally compiled address list.
 19. A method as inclaim 3 further comprising the following steps: unless the correcte-mail response is received from the sender address, including thesender address in a list of blocked sender addresses; and blockingwithout further challenge any e-mail message received from any addressincluded in the list of blocked sender addresses.
 20. A method as inclaim 19, further comprising the step of including user-specified e-mailaddresses in the list of blocked sender addresses.
 21. A method as inclaim 19, further comprising the step of including e-mail addressesobtained from an externally compiled address list in the list of blockedsender addresses.
 22. A method as in claim 19, further comprising thestep of including the sender address in the list of blocked senderaddresses unless the correct e-mail response is received according to aformal response criterion.
 23. A method as in claim 19, furthercomprising the step of providing the list of blocked addresses to thirdparties.
 24. A method as in claim 3 further comprising the followingsteps: notifying the user of receipt of the current e-mail message andprompting to indicate whether to send the challenge; and sending thechallenge only if the user indicates that the challenge should be sent.25. A method as in claim 1 further including the steps of calculating,for each challenge, a corresponding key, and including the key in thechallenge.
 26. A method as in claim 25 further including the step ofaccepting for display to the user, without challenge, any incomingmessage that contains a correctly calculated key.
 27. A method as inclaim 25 further including the step of accepting for display to theuser, without challenge, any incoming message that both contains acorrectly calculated key and is sent from a sender address to which theuser previously initiated sending a message.
 28. A method for filteringelectronic mail (e-mail) sent to a user comprising: receiving a currente-mail message from a current sender address; via e-mail, returning tothe current sender address a challenge that requires a correct e-mailresponse, the challenge including an instruction to perform an actionand the correct e-mail response requiring correct performance of theaction; if the correct e-mail response is received from the currentsender address, including the current sender address in a list ofapproved sender addresses and accepting without challenge the currente-mail message and any e-mail message sent from an address included inthe list of approved sender addresses; and if the correct e-mailresponse is not received from the current sender address, including thecurrent sender address in a list of blocked sender addresses andblocking without further challenge any e-mail message received from anyaddress included in the list of blocked sender addresses, including thecurrent e-mail message.
 29. A system for filtering electronic mail(e-mail) sent to a user comprising: a computer that is connected to anetwork over which e-mail is transmitted; a computer program executingon the computer, wherein the computer program comprises computerinstructions for: receiving a current e-mail message from a senderaddress to a user address; via e-mail, returning to the sender address achallenge that requires a correct e-mail response; and blocking thecurrent e-mail message from the sender address unless the correct e-mailresponse is received by the computer from the sender address.
 30. Asystem as in claim 29, in which the computer program further comprisescomputer instructions for generating the challenge to include aninstruction to perform an action, the correct e-mail response requiringcorrect performance of the action.
 31. A system as in claim 30, furthercomprising an approved list storing approved sender addresses, in whichthe computer program further comprises computer instructions for:including the sender address in a list of approved sender addresses andfor accepting the current e-mail message upon receipt of the correcte-mail response from the sender address; and accepting without challengeany e-mail message sent from an address included in the list of approvedsender addresses.
 32. A system as in claim 30, further comprising ablocked list storing disapproved sender addresses, in which the computerprogram further comprises computer instructions for: including thesender address in a list of blocked sender addresses unless the correcte-mail response is received from the sender; and blocking withoutfurther challenge any e-mail message received from any address includedin the list of blocked sender addresses.
 33. A system as in claim 29,further comprising a challenge generation module generating thechallenge to include an instruction to perform an action, the correcte-mail response requiring correct performance of the action.
 34. Asystem as in claim 33, further comprising a response analysis moduleanalyzing any e-mail response from the sender address and determiningwhether the e-mail response is correct.
 35. A system as in claim 33, inwhich the challenge generation module is provided for downloadingchallenges via the network from an external challenge-generation systemand selecting for sending to the sender address at least one of thedownloaded challenges.
 1. A method for filtering electronic mail(e-mail) sent to a user comprising: receiving a current e-mail messagefrom a sender address; via e-mail, returning to the sender address achallenge that requires a correct e-mail response; and blocking thecurrent e-mail message from the sender address unless the correct e-mailresponse is received by the user system from the sender address. 2.-35.(canceled)